Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery (CVE-2026-106148)
Description
October 2026 - CVE-2026-106148
- Progress® Kendo® UI for jQuery 2026 Q3 (2026.3.811) or earlier.
What Are the Impacts
The TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can introduce additional attributes, including event handlers. JavaScript can execute in a user's browser when the affected component renders the image, compromising the confidentiality and integrity of data accessible to the affected application.
Is My Application Vulnerable?
Your application may be vulnerable if it uses an affected version and renders attacker-controlled imageUrl values from a TabStrip, Menu, or PanelBar data source.
Issue
- CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
- CAPEC-18: XSS Targeting Non-Script Elements
Solution
We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.
| Current Version | Update to |
|---|---|
>= 2011.2.804 && <= 2026.3.811 | >= 2026.3.1015 |
Follow the update instructions for precise instructions. All customers who have a license for Progress® Kendo® UI for jQuery can access their downloads here Product Downloads | Your Account.
Notes
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
- The first affected version has not been confirmed.
- We would liek to thank Abhishek Nandkumar Bhaskar (Abhi-Hackz), HanTul, and komyeonghane320f9 for their responsible disclosure and cooperation.
External References
CVE-2026-106148 (Medium)
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (5.4)
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject additional HTML attributes, including event handlers, and execute JavaScript in a user's browser when the affected component renders the image. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. The earliest affected version has not been confirmed. This issue is fixed in version 2026.3.1015.
Finder Credit:
- Abhishek Nandkumar Bhaskar (Abhi-Hackz)
- komyeonghane320f9
- HanTul